Stuxnet-style code signing is more widespread than anyone thought

Stuxnet-style code signing is more widespread than anyone thought

By | November 6th, 2017
No Comments on Stuxnet-style code signing is more widespread than anyone thought

Forgeries undermine the trust millions of people place in digital

certificates.


														
							

Now, researchers have presented proof that digitally signed malware is much more common than previously believed. What’s more, it predated Stuxnet, with the first known instance occurring in 2003. The researchers said they found 189 malware samples bearing valid digital signatures that were created using compromised certificates issued by recognized certificate authorities and used to sign legitimate software. In total, 109 of those abused certificates remain valid.

The researchers, who presented their findings Wednesday at the ACM Conference on Computer and Communications Security, found another 136 malware samples signed by legitimate CA-issued certificates, although the signatures were malformed.

The forgeries also allow malware to evade antivirus protections. Surprisingly, weaknesses in the majority of available AV programs prevented them from detecting known malware that was digitally signed even though the signatures weren’t valid.

Source

Google
Nisheeth Bhakuni